DevOps

Hello Everyone, We have an AMI product on AWS and I have been updating the version as we make progress on our application. I have never changed from the way I have created the AMI that I am associating with the new version of the product. Last night I tried to change the version of the AMI product and put in the new AMI and received the following error which I have never seen before and can't find any information on it on the interwebs. Ebs unoptimized product This product does not support EBS optimized AMIs. Provide a new AMI that has EBS Optimization disable. Did I click on something by accident that would make this message appear? Any help would be greatly appreciated. Thanks!

I created an IAM user and attached a [Permission Boundary Policy to it ](https://aws.amazon.com/premiumsupport/knowledge-center/iam-permission-boundaries/). The permission boundary does not work when I deploy a CDK stack. My terminal setup with access_key_id, and secrete_access_key of the IAM user (attached permission boundary). ``` cdk deploy iamUserWitthAdminAccess ``` Here is the stack ``` new aws_iam.User( this, "IamUserWithAdminAccess", { managedPolicies: [ aws_iam.ManagedPolicy.fromAwsManagePolicyName("AdmininstratorAccess")] } ) ``` Then an IAM user with AdminAccess was able to created. Can any one explain? and what is the best practice to prevent CDK to create Admin Users?

Hi, We've an odd issue with Amazon inspector. Recently we've pushed multiple Docker images into private ECR repositories, and we're scanning them with "Enhanced scanning" and "Continuously scan all repositories" - we have no scanning overrides on individual repositories and no suppression rules; our "*" filter is actively scanning all images. The scan results appear fine in ECR if you select a repository then click the "See findings" link under "Vulnerabilities" - we see critical package vulnerabilities. However: in Inspector, the "Critical findings" panel of the dashboard always displays "0 Critical" under "ECR Container". It also doesn't show the critical issue findings if you filter "By container image" or "By repository" - nothing. But: if you select "All findings" the critical ECR package issues are visible... We had thought this might be some sort of dashboard update issue, but it's been like that for over 12 hours now. What do we need to do to get our scanned critical ECR image vulnerabilities reported on the main Inspector dashboard stats? Thanks. [Dashboard Findings: Criticals 0](https://ibb.co/ZcNBFm3) [Container Image Findings: Empty](https://ibb.co/Zgtg5NZ) [All Findings - Criticals present and correct](https://ibb.co/NTw8vpX)

Hi - We are using CfCT, which is great. We currently have cloudformation templates mapped to specific Organizational Units and it works like a charm. I now have a AWS SAM Template that I would like to deploy but I could find 0 documentation about it. At the solution repository, I can see that are features enabled to support SAM[1], but no guidance on how to do it. Could you please share more information on how to deploy a AWS SAM Template through CfCT? [1] - https://github.com/aws-solutions/aws-control-tower-customizations/blob/08f76abd9548cc88d091ab6a8d8f127c768c331b/CHANGELOG.md#L18

We are trying to establish a pipeline notification rule to SNS topic to Microsoft Teams channel (via Lambda function). This has already been accomplished multiple times with manual configuration, but now we want to implement it with automation with CDK. https://docs.aws.amazon.com/cdk/api/v1/dotnet/api/Amazon.CDK.AWS.CodePipeline.Pipeline.html#Amazon_CDK_AWS_CodePipeline_Pipeline_NotifyOnExecutionStateChange_System_String_Amazon_CDK_AWS_CodeStarNotifications_INotificationRuleTarget_Amazon_CDK_AWS_CodeStarNotifications_INotificationRuleOptions_ The NotifyOnExecutionStateChange() wants an INotificationRuleTarget, but I *cannot find anything* that implements that interface. https://docs.aws.amazon.com/cdk/api/v1/dotnet/api/Amazon.CDK.AWS.CodeStarNotifications.html The CodeStarNotifications library does not appear to have a corresponding class to that interface. What's the class to use?

Hi, I would like to enable dynamodb stream on an existing dynamodb table using cloudformation template. I searched but could not find anything in this regard. I see there is way to enable dynamodb stream for an existing table using console but couldn't find any way to achieve same using cloudformation template. Can you help with this .

Hi Gurus, I am working on setting up VMC on AWS. Can anybody please advise with Bill of materials(minimum required template) for setting up VMC on AWS? Thanks Jo

Hi, im recently check throught this blog: https://aws.amazon.com/blogs/security/deploy-dashboard-for-aws-waf-minimal-effort/ but seems the cfn template link have a permission issues. Exist any updated version for that solution or another similar ? Thanks in advance,

Hi team, I'm looking for the best option to handle SES feedback loop in AWS? We have to handle bounces and complaints. if the user REPORT SPAM or if the email bounces (because you delete your email or the mailbox is full). **so we need to store feedback loop somewhere ** Thank you :)

Hi, We want to implement a pessimistic locking of code commit and wanted to find out steps to implement this. Would appreciate if anyone can provide guidance on this. Thank you

I am getting the errors: 1>error LNK2001: unresolved external symbol "__declspec(dllimport) void __cdecl Aws::InitAPI(struct Aws::SDKOptions const &)" (__imp_?InitAPI@Aws@@YAXAEBUSDKOptions@1@@Z) 1>error LNK2001: unresolved external symbol "__declspec(dllimport) public: __cdecl Aws::Client::ClientConfiguration::ClientConfiguration(void)" (__imp_??0ClientConfiguration@Client@Aws@@QEAA@XZ) . . . 1> fatal error LNK1120: 21 unresolved externals I am building my application with VS2019 but with the VS2015 runtime libraries (v140). 64 bit release and debug. Multi-threaded libraries (/MT) I used vcpkg to obtain the AWSSDK and I believe I built the SDK to match my configuration. I am linking with aws-cpp-sdk-s3.lib;aws-cpp-sdk-core.lib. I am defining USE_WINDOWS_DLL_SEMANTICS and USE_IMPORT_EXPORT in my code Any suggestions would be much appreciated. Thank you.

I'm quite new at AWS and use mostly the console to build my project. I have placed a containerized Streamlit web app in an AWS EC2/ECS instance beyond an ALB (https listener with session timeout 3960 secs.) and let users access it through Cognito authentication with Authorization code grant. Everything works fine, users are allowed to the app. Now, I would like users to be authomatically logged out after 60 minutes and redirected to the signout URL. I've set the refresh token expiration at 60 min., the access token and ID token expiration at 5 min. However, the backend continues delivering data to logged in users even after 60 minutes, so my idea doesn't work. Then, I've implemented a Lambda function with admin_user_global_sign_out but it doesn't work either: users do still get data from the backend. I'm wondering what I shall do and looking for a solution that I can implement using the AWS console so that the procedure is clear to me. Thank you for any help.

One box stage in CICD pipeline is a stage before production stage. This stage also will receive the production traffic. The goal of this stage is to validate the new changes with very small prod traffic and keep the blast radius to minimal incase of issues. In server based deployment, this stage will contain only 1 machine to receive very small % of traffic. The code changes will be deployed to 1-box stage before production and leave it for some time to validate the behaviour of new change. If there is an issue in 1-box stage with the new code, the blast radius will be minimal and roll back is faster since the changes are deployed in only one machine. It is explained in "Backward compatibility and one-box testing" topic in this link - https://aws.amazon.com/builders-library/automating-safe-hands-off-deployments/ How do we setup the same in lambda ci-cd ? Any leads on this will be super helpful.

I have a few team members want to work on different parts of a solution architecture. They should be able to create the following resources in their accounts, consume any updates from other team members updates to the whole solution architecture and test. These are the resources: 1. EventBridge (1 ESB) 2. C# Lambdas (6 Lambdas) 3. Cron Jobs (4 Cron Jobs) 4. On-Prem client applications (1 JavaScript applicaiton) This is our SDLC process: 1. We will use the AWS C# CDK to create the resources and roles. 2. On-Prem Jenkins to create a CI/CD To accomplish smooth development and deployment of the projects, what is the recommended way to split the projects into GitHub repositories? 1. Should the CDK (Infrastructure as Code) to create all the resources be a separate repository? Can this help the developer to deploy the resources in a single execution? 2. Should the CDK (Infrastructure as Code) to create the resource be part of the lambda or cron job itself? Any suggestions appreciated.

Hello, I wanted to ask you if it is possible to create an OpenLiteSpeed web server app using AWS Elastic Beanstalk. I'm planning on launching a WordPress site with it. I have just created one but it creates it with NGINX and gives me the option to change it to Apache. Do you have any docs on how to do it? If possible.

Can you tag an existing cloudformation resource in the console or cli?

Hi team, I have a glue workflow : trigger (type = "EVENT") => trigger a glue job (to take data from S3 and push them to MySQL RDS) I configured the glue Triggering criteria to kickoff the glue job after 5 events were received. in the console it says : > Specify the number of events received or maximum elapsed time before firing this trigger. > Time delay in seconds (optional) on AWS documentation it says also it's not required : ``` BatchWindow Window of time in seconds after which EventBridge event trigger fires. Window starts when first event is received. Type: Integer Valid Range: Minimum value of 1. Maximum value of 900. Required: No ``` So I want only my trigger to be triggered only and only after 5 events are received and not depending on: Time delay in seconds (optional). actually, the Time delay in seconds (optional) is set to 900 by default and my job is started after 900s even if there are no 5 events received. that's not the behaviour we want. We want ONLY the job to be started after x events are received. I tried via the console to edit the trigger and remove the 900s for the Time delay in seconds (optional) input but I can't save it until I put a value on it. it says it's optional but it doesn't seem to be. is there a workaround to make the trigger not take account of Time delay in seconds (optional)? and only be launched when it received x events and nothing else. right now the behaviour I have is that my job is triggered after 900s, we want to eliminate this case and let the job be triggered only and only if there is x event received and nothing else. how can I make the Time delay in seconds (optional) input optional, because now the console forces me to put a value in there? thank you.

Hello, I have finished the setup of Systems Manager Change Manager, I created the SNS Topic for Template Reviewers, Change Request Approvers and also another one for Notifications of the change request progress. Every time I run a Change Request it says on the Timeline: ``` Failed to publish notifications to SNS. ``` I have tried to use the same Topic of Approvers and Template Reviewers (where I know the emails are being sent correctly) but the error is the same, I would like to know what am I missing ? Does the Topic need a different Access Policy ? Do I need to add a SNS Policy to another role ? Thanks for your insights.